Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-39987

Published 2026-04-09

Updated 3 months ago

Vendor/s

Marimo

Product/s

Marimo

Version/s

\* > 0.23.0

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-39987 is a critical pre-auth RCE in Marimo notebooks via the terminal WebSocket endpoint. Update to version 0.23.0 immediately.

## Why this matters

CVE-2026-39987 is a critical pre-authentication Remote Code Execution (RCE) vulnerability in Marimo, a reactive Python notebook. Because the /terminal/ws WebSocket endpoint completely bypasses authentication checks, any unauthenticated attacker with network access can gain a full PTY shell and execute arbitrary system commands. This flaw is particularly dangerous as it is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Organizations using Marimo for data science or development must act immediately, as this vulnerability provides a direct path for attackers to compromise the underlying host environment and sensitive data.

## CPE

Marimo

| Product | Version Start | Version End (excl.) | Status     |
| ------- | ------------- | ------------------- | ---------- |
| marimo  | \*            | 0.23.0              | vulnerable |

## Related weakness (CWE)

CWE-306

## Remediation plan

1

### Apply official patches

Update your Marimo installation to version 0.23.0 or later, which introduces the necessary authentication validation for the terminal WebSocket endpoint.

2

### Update affected systems

Identify all instances of Marimo running versions prior to 0.23.0 and ensure they are upgraded immediately to mitigate the risk of unauthorized shell access.

3

### Restrict access

Implement network-level access controls, such as firewalls or VPNs, to ensure that Marimo instances are not exposed to the public internet, specifically blocking unauthorized access to the /terminal/ws endpoint.

4

### Monitor for exploitation

Review application logs for unusual connection requests to the /terminal/ws endpoint, especially those originating from unexpected IP addresses or occurring without corresponding authenticated sessions.

## Detection Guidance

Detection should focus on identifying unauthorized WebSocket upgrades to the /terminal/ws path. Monitor web server and application logs for HTTP 101 Switching Protocols responses to this specific endpoint from unauthenticated or external IP addresses. Additionally, look for unusual child processes spawned by the Marimo application, such as unexpected shell activity (e.g., /bin/sh, /bin/bash) or network callouts that deviate from normal data science workflows.

## References

[https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a Patch ](https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a)[https://github.com/marimo-team/marimo/pull/9098 Issue Tracking Patch ](https://github.com/marimo-team/marimo/pull/9098)[https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc Exploit Mitigation Vendor Advisory ](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-39987 US Government Resource ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987)[https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours Exploit Third Party Advisory](https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)